{"record":{"id":"9a79c6e2e9bdfd41","repo":"NationalSecurityAgency/ghidra","slug":"no-password-provided-9a79c6","errorCode":null,"errorMessage":"No password provided","messagePattern":"No password provided","errorType":"validation","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java","lineNumber":3423,"sourceCode":"\t\t}\n\t\tcatch (ElasticException e) {\n\t\t\tresponse.dropSuccessful = false;\n\t\t\tresponse.errorMessage = e.getMessage();\n\t\t}\n\t}\n\n\t/**\n\t * Entry point for the Elasticsearch version of PasswordChange command.\n\t * @param query is command parameters\n\t * @throws LSHException if details of the request are malformed\n\t */\n\tprivate void fdbPasswordChange(PasswordChange query) throws LSHException {\n\t\tResponsePassword response = query.passwordResponse;\n\t\tif (query.username == null) {\n\t\t\tthrow new LSHException(\"Missing username for password change\");\n\t\t}\n\t\tif (query.newPassword == null || query.newPassword.length == 0) {\n\t\t\tthrow new LSHException(\"No password provided\");\n\t\t}\n\t\tresponse.changeSuccessful = true;\t\t// Response parameters assuming success\n\t\tresponse.errorMessage = null;\n\t\ttry {\n\t\t\tchangePasswordInternal(query.username, query.newPassword);\n\t\t}\n\t\tcatch (ElasticException ex) {\n\t\t\tresponse.changeSuccessful = false;\n\t\t\tresponse.errorMessage = ex.getMessage();\n\t\t}\n\t\tquery.clearPassword();\n\t}\n\n\t/**\n\t * Given the document id for a specific function. Query for the document and\n\t * produce the corresponding FunctionDescription\n\t * @param manager is the container for the new FunctionDescription\n\t * @param rowId is the document id of the function","sourceCodeStart":3405,"sourceCodeEnd":3441,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java#L3405-L3441","documentation":"Thrown by ElasticDatabase.fdbPasswordChange when a PasswordChange command is submitted whose newPassword field is null or a zero-length char array. It is a pure client-side validation of the request payload before any network call to Elasticsearch is made; the username is validated separately just above. The check exists because an empty password cannot be used to change PostgreSQL/Elastic user credentials.","triggerScenarios":"Constructing a PasswordChange (or calling SimilarFunctionQueryService.changePassword) with newPassword == null or new char[0]. Also firing a raw PasswordChange BSimQuery against an ElasticDatabase whose .newPassword was never assigned.","commonSituations":"A GUI/script password-change flow whose input dialog returned empty; a char[] whose contents were cleared (Arrays.fill) before being passed in; a unit test stubbing the password to null.","solutions":["Validate the password char array is non-null and length > 0 before building the PasswordChange command.","If prompting a user, reject an empty entry in the dialog/prompt layer and re-ask, so the command never carries an empty password.","When wrapping changePassword in a service, surface a clear 'Password required' UI message rather than letting the LSHException escape."],"exampleFix":"// before\nPasswordChange cmd = new PasswordChange();\ncmd.username = user;\ncmd.newPassword = entered; // entered may be null\n// after\nif (entered == null || entered.length == 0) {\n    throw new IllegalArgumentException(\"Password required\");\n}\nPasswordChange cmd = new PasswordChange();\ncmd.username = user;\ncmd.newPassword = entered;","handlingStrategy":"validation","validationCode":"// before constructing PasswordChange\nif (newPassword == null || newPassword.length == 0) {\n    throw new IllegalArgumentException(\"Password required\");\n}\nPasswordChange cmd = new PasswordChange();\ncmd.username = username;\ncmd.newPassword = newPassword;","typeGuard":"static boolean hasUsablePassword(char[] pw) {\n    return pw != null && pw.length > 0;\n}","tryCatchPattern":"try {\n    passwordChange.execute(database);\n} catch (LSHException e) {\n    if (e.getMessage().contains(\"No password provided\")) {\n        // re-prompt the user for a password\n    } else {\n        throw e;\n    }\n}","preventionTips":["Treat password capture (dialog/prompt) as the validation boundary; never forward an empty char[].","Clear password arrays only after the command has consumed them, not before construction.","Unit-test the password-change path with empty/null inputs to assert your guard fires first."],"tags":["bsim","elasticsearch","validation","password","argument-error"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}